RDMA/irdma: Prevent user-triggered null deref on QP create

Previously, the user QP creation path would only attempt to
populate iwqp->iwpbl if the user-provided req.user_wqe_bufs
field was non-zero. The problem is that iwqp->iwpbl is
unconditionally dereferenced later on in irdma_setup_virt_qp.

While there was a check for iwqp->iwpbl != NULL, this check
would only occur if req.user_wqe_bufs was non-zero. The end
result is that a user could send a zero user_wqe_bufs value
and trigger a null ptr deref.

Fix this by unconditionally calling irdma_get_pbl and bailing
if it fails, similar to the CQ and SRQ paths.

Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Link: https://patch.msgid.link/r/20260617164013.280790-1-jmoroni@google.com
Signed-off-by: Jacob Moroni <jmoroni@google.com>
Reviewed-by: David Hu <xuehaohu@google.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index 23ab8286dc12b0ee14b17cf3c52da52f7ccdcc99..be8c5cf12f7ff0e9adeed9116907d5e9763c086f 100644 (file)
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -633,17 +633,16 @@ static int irdma_setup_umode_qp(struct ib_udata *udata,
 
        iwqp->ctx_info.qp_compl_ctx = req.user_compl_ctx;
        iwqp->user_mode = 1;
-       if (req.user_wqe_bufs) {
-               spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags);
-               iwqp->iwpbl = irdma_get_pbl((unsigned long)req.user_wqe_bufs,
-                                           &ucontext->qp_reg_mem_list);
-               spin_unlock_irqrestore(&ucontext->qp_reg_mem_list_lock, flags);
 
-               if (!iwqp->iwpbl) {
-                       ret = -ENODATA;
-                       ibdev_dbg(&iwdev->ibdev, "VERBS: no pbl info\n");
-                       return ret;
-               }
+       spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags);
+       iwqp->iwpbl = irdma_get_pbl((unsigned long)req.user_wqe_bufs,
+                                   &ucontext->qp_reg_mem_list);
+       spin_unlock_irqrestore(&ucontext->qp_reg_mem_list_lock, flags);
+
+       if (!iwqp->iwpbl) {
+               ret = -ENODATA;
+               ibdev_dbg(&iwdev->ibdev, "VERBS: no pbl info\n");
+               return ret;
        }
 
        if (!ucontext->use_raw_attrs) {